3.2. Point-to-Site VPN

Your workforce is distributed—employees work from home, coffee shops, airports. How do they securely access Azure resources without exposing those resources to the internet? Point-to-Site (P2S) VPN connects individual devices directly to your Azure network through encrypted tunnels.

💡 First Principle: P2S solves the "remote worker" problem. Unlike S2S (site-to-site), P2S doesn't require a hardware VPN device—the connection originates from VPN client software on each user's device. Think of it like giving each employee a secure, private tunnel into the office.

What breaks without P2S:

• Remote workers can't access Azure-hosted applications and data
• You're forced to expose internal services to the internet
• Developers can't reach dev/test environments from home
• Compliance fails because remote access isn't encrypted

Consider this scenario: a developer needs to connect to an Azure SQL database from their laptop at home. The database has no public endpoint (by design). Without P2S, they'd need to RDP through a jump box, add a public IP (security risk), or give up. P2S provides the secure middle ground.